From: Philippe Antoine <pantoine@oisf.net>
Date: Fri, 17 Nov 2023 11:03:11 +0000 (+0100)
Subject: enip: Add test for logger
X-Git-Tag: suricata-6.0.20~15
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4e9508230dfba815eafcbb7a50452684242ff262;p=thirdparty%2Fsuricata-verify.git

enip: Add test for logger
---

diff --git a/tests/enip-log-identity/README.md b/tests/enip-log-identity/README.md
new file mode 100644
index 000000000..2059f843e
--- /dev/null
+++ b/tests/enip-log-identity/README.md
@@ -0,0 +1,8 @@
+# Description
+
+Test ENIP logging
+And enip_command keyword with enumeration string
+
+# PCAP
+
+The pcap comes from https://redmine.openinfosecfoundation.org/issues/3886
diff --git a/tests/enip-log-identity/suricata.yaml b/tests/enip-log-identity/suricata.yaml
new file mode 100644
index 000000000..8c467785c
--- /dev/null
+++ b/tests/enip-log-identity/suricata.yaml
@@ -0,0 +1,19 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+
+      types:
+        - alert
+        - anomaly
+        - enip
+        - flow
+
+app-layer:
+  protocols:
+    enip:
+      enabled: yes
diff --git a/tests/enip-log-identity/test.rules b/tests/enip-log-identity/test.rules
new file mode 100644
index 000000000..62a9aa1ca
--- /dev/null
+++ b/tests/enip-log-identity/test.rules
@@ -0,0 +1 @@
+alert enip any any -> any any (msg:"SURICATA enip test command string";enip_command:list_identity ; sid:1;)
diff --git a/tests/enip-log-identity/test.yaml b/tests/enip-log-identity/test.yaml
new file mode 100644
index 000000000..9a6d00701
--- /dev/null
+++ b/tests/enip-log-identity/test.yaml
@@ -0,0 +1,27 @@
+requires:
+  min-version: 8
+
+pcap:  ../enip-alert/enip_test1.pcap
+
+# disables checksum verification
+args:
+- -k none
+
+checks:
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 1
+        # check enip metadata in alert
+        enip.request.command: list_identity
+  - filter:
+      count: 1
+      match:
+        event_type: enip
+        enip.request.command: list_identity
+        enip.response.status: success
+        # quote because this is a string, not a yaml float
+        enip.response.identity.revision: "4.3"
+        enip.response.identity.product_name: "1756-ENBT/A"
+        enip.response.identity.vendor_id: "Rockwell Automation/Allen-Bradley"